[PATCH 6.1.y] mm/damon/vaddr: drop last same folio access check optimization

[PATCH 6.1.y] mm/damon/vaddr: drop last same folio access check optimization

[SJ Park]

The optimization can race when multiple kdamonds are running.  Meanwhile,
the impact of the optimization is quite doubtful.  Just remove it.

The user impact of the issue should be quite trivial.  After all, the race
can happen only when the user intentionally setup DAMON in the way.  Even
if it happens, it would be rare and only degrade the best-effort
monitoring results.  No critical consequences like kernel panic or memory
corruption happen.

The race possibility was discovered [1] by Sashiko.

Link: https://lore.kernel.org/20260715031002.108504-4-sj@kernel.org
Link: https://lore.kernel.org/20260621204050.10993-1-sj@kernel.org [1]
Fixes: 3f49584b262c ("mm/damon: implement primitives for the virtual memory address spaces")
Signed-off-by: SJ Park <sj@kernel.org>
Cc: <stable@vger.kernel.org> # 5.15.x
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
(cherry picked from commit 831846078caa14b7d00b2ccca8b8fe522afe3204)
Signed-off-by: SJ Park <sj@kernel.org>
---
 mm/damon/vaddr.c | 42 +++++++++---------------------------------
 1 file changed, 9 insertions(+), 33 deletions(-)

diff --git a/mm/damon/vaddr.c b/mm/damon/vaddr.c
index 708f281c1b6b4..4aa89347d754d 100644
--- a/mm/damon/vaddr.c
+++ b/mm/damon/vaddr.c
@@ -424,7 +424,6 @@ static void damon_va_prepare_access_checks(struct damon_ctx *ctx)
 }
 
 struct damon_young_walk_private {
-	unsigned long *page_sz;
 	bool young;
 };
 
@@ -453,10 +452,8 @@ static int damon_young_pmd_entry(pmd_t *pmd, unsigned long addr,
 			goto huge_out;
 		if (pmd_young(*pmd) || !page_is_idle(page) ||
 					mmu_notifier_test_young(walk->mm,
-						addr)) {
-			*priv->page_sz = HPAGE_PMD_SIZE;
+						addr))
 			priv->young = true;
-		}
 		put_page(page);
 huge_out:
 		spin_unlock(ptl);
@@ -475,10 +472,8 @@ static int damon_young_pmd_entry(pmd_t *pmd, unsigned long addr,
 	if (!page)
 		goto out;
 	if (pte_young(*pte) || !page_is_idle(page) ||
-			mmu_notifier_test_young(walk->mm, addr)) {
-		*priv->page_sz = PAGE_SIZE;
+			mmu_notifier_test_young(walk->mm, addr))
 		priv->young = true;
-	}
 	put_page(page);
 out:
 	pte_unmap_unlock(pte, ptl);
@@ -505,10 +500,8 @@ static int damon_young_hugetlb_entry(pte_t *pte, unsigned long hmask,
 	get_page(page);
 
 	if (pte_young(entry) || !page_is_idle(page) ||
-	    mmu_notifier_test_young(walk->mm, addr)) {
-		*priv->page_sz = huge_page_size(h);
+	    mmu_notifier_test_young(walk->mm, addr))
 		priv->young = true;
-	}
 
 	put_page(page);
 
@@ -525,11 +518,9 @@ static const struct mm_walk_ops damon_young_ops = {
 	.hugetlb_entry = damon_young_hugetlb_entry,
 };
 
-static bool damon_va_young(struct mm_struct *mm, unsigned long addr,
-		unsigned long *page_sz)
+static bool damon_va_young(struct mm_struct *mm, unsigned long addr)
 {
 	struct damon_young_walk_private arg = {
-		.page_sz = page_sz,
 		.young = false,
 	};
 
@@ -546,25 +537,13 @@ static bool damon_va_young(struct mm_struct *mm, unsigned long addr,
  * r	the region to be checked
  */
 static void __damon_va_check_access(struct mm_struct *mm,
-				struct damon_region *r, bool same_target)
+				struct damon_region *r)
 {
-	static unsigned long last_addr;
-	static unsigned long last_page_sz = PAGE_SIZE;
-	static bool last_accessed;
-
-	/* If the region is in the last checked page, reuse the result */
-	if (same_target && (ALIGN_DOWN(last_addr, last_page_sz) ==
-				ALIGN_DOWN(r->sampling_addr, last_page_sz))) {
-		if (last_accessed)
-			r->nr_accesses++;
-		return;
-	}
+	bool accessed;
 
-	last_accessed = damon_va_young(mm, r->sampling_addr, &last_page_sz);
-	if (last_accessed)
+	accessed = damon_va_young(mm, r->sampling_addr);
+	if (accessed)
 		r->nr_accesses++;
-
-	last_addr = r->sampling_addr;
 }
 
 static unsigned int damon_va_check_accesses(struct damon_ctx *ctx)
@@ -573,17 +552,14 @@ static unsigned int damon_va_check_accesses(struct damon_ctx *ctx)
 	struct mm_struct *mm;
 	struct damon_region *r;
 	unsigned int max_nr_accesses = 0;
-	bool same_target;
 
 	damon_for_each_target(t, ctx) {
 		mm = damon_get_mm(t);
 		if (!mm)
 			continue;
-		same_target = false;
 		damon_for_each_region(r, t) {
-			__damon_va_check_access(mm, r, same_target);
+			__damon_va_check_access(mm, r);
 			max_nr_accesses = max(r->nr_accesses, max_nr_accesses);
-			same_target = true;
 		}
 		mmput(mm);
 	}
-- 
2.47.3

Re: [PATCH 6.1.y] mm/damon/vaddr: drop last same folio access check optimization

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The PMD is read directly via `*pmd` outside a lock, which can cause torn reads on architectures where PMD size is larger than the word size (e.g., 32-bit PAE).
--

commit 3ab3595f2bebbbf09add4e61c160f37ee6aa2807
Author: SJ Park <sj@kernel.org>

mm/damon/vaddr: drop last same folio access check optimization

This commit removes the same-folio access check optimization from DAMON's
virtual address monitoring. The optimization was found to race when multiple
kdamonds are running, and its impact was deemed doubtful.

Link: https://lore.kernel.org/20260715031002.108504-4-sj@kernel.org
Link: https://lore.kernel.org/20260621204050.10993-1-sj@kernel.org [1]

> diff --git a/mm/damon/vaddr.c b/mm/damon/vaddr.c
> index 708f281c1b6b4..4aa89347d754d 100644
> --- a/mm/damon/vaddr.c
> +++ b/mm/damon/vaddr.c
[ ... ]
> @@ -453,10 +452,8 @@ static int damon_young_pmd_entry(pmd_t *pmd, unsigned long addr,
>  			goto huge_out;
>  		if (pmd_young(*pmd) || !page_is_idle(page) ||
>  					mmu_notifier_test_young(walk->mm,
> -						addr)) {
> -			*priv->page_sz = HPAGE_PMD_SIZE;
> +						addr))
>  			priv->young = true;

[Severity: High]
This is a pre-existing issue, but does reading the PMD directly via *pmd
outside a lock risk torn reads on architectures where the PMD size is larger
than the word size (like 32-bit PAE)?

Earlier in damon_young_pmd_entry(), the code does:

if (pmd_trans_huge(*pmd)) {
        ptl = pmd_lock(walk->mm, pmd);

Since damon_young_pmd_entry() runs during DAMON's page table walk under
mmap_read_lock(), concurrent THP modifications aren't prevented. If a torn
read occurs on the lockless *pmd evaluation during a concurrent THP split or
collapse, it could bypass both the pmd_trans_huge() and pmd_bad() checks.

If it falls through to the regular page path, pte_offset_map_lock() might
map a bogus physical address from the torn value, allowing arbitrary memory
to be treated as PTEs.

A similar lockless check appears to exist in damon_mkold_pmd_entry() as
well. Could these paths use pmd_read_atomic() or pmdp_get_lockless() to
safely evaluate the PMD?

> -		}
>  		put_page(page);
>  huge_out:
>  		spin_unlock(ptl);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260909061152.278678-1-sj@kernel.org?part=1

Re: [PATCH 6.1.y] mm/damon/vaddr: drop last same folio access check optimization

[Sasha Levin]

> The optimization can race when multiple kdamonds are running.  Meanwhile,
> the impact of the optimization is quite doubtful.  Just remove it.

Queued for 6.1, thanks.

-- 
Thanks,
Sasha